Counsel, and when to call.

The default posture across Red Hat audits is that legal counsel is not the primary response channel. The advisor is. The audit defense engagement is treated as a contract management matter that turns on entitlement records, deployment evidence, and the contractual reading of subscription terms. The customer's general counsel is briefed as a matter of course but is not on the response calls. The practice's reading across the trailing twelve months is that roughly seven in twelve defenses ran this way through to settlement, and the question of when to bring in legal counsel for a Red Hat audit did not turn material.1

The default holds because the matter is rarely about contractual interpretation in dispute. The matter is usually about entitlement reconciliation against deployment. The reconciliation work is operational and analytical; the customer's advisor and the customer's platform team do the work; the audit team reads the response on its merits. Counsel does not move the work forward. Counsel adds time and adds cost without adding to the response strength.

The default does not hold in every case. The remaining five defenses in twelve in the practice's trailing twelve month sample required counsel as a primary response channel at some stage. The triggers for that escalation are the operative question of this note.

The practice's protocol is to engage counsel when one or more of five conditions hold. The conditions are not exhaustive but they capture the operative cases. Each is set out below with the recommended posture.

The triggers operate independently. Any single trigger is sufficient to bring counsel into the response as a co channel; multiple triggers concurrent indicates that counsel should be the primary channel and the advisor should brief counsel rather than the customer directly. The note on settlement negotiation leverage treats the substantive negotiation work; the present note treats the channel question.

When counsel is engaged early in the response, attorney client privilege can extend to certain communications produced for the purpose of the legal advice. The privilege is jurisdiction specific and fact dependent and the present note is not a substitute for advice from the customer's own counsel. The relevant operational point for the practice is that when counsel is engaged, certain work product previously produced by the advisor can be brought under the privilege umbrella if the engagement letter is structured for that purpose. The practice's reading is that this is rarely the operative reason to engage counsel but is a useful secondary benefit when the engagement is justified by one of the triggers in § 2.2

Customers who engage counsel late and then attempt to extend privilege retroactively over advisor work product find the position weakly supported. Customers who engage counsel at the moment of a triggering condition and structure the engagement properly find that the relevant work product is protected from the outset. The practice coordinates with the customer's counsel on engagement structure when counsel is brought in.

The companion notes on working with the Red Hat account team during an audit and responding to the compliance letter treat the channel hygiene that supports privilege; the present note treats the substantive moment when privilege becomes operative.

Where counsel is in the response, the division of work between counsel and advisor matters. The practice's protocol is that the advisor remains the primary analyst on the entitlement record, the deployment evidence, and the contractual reading of subscription terms. Counsel becomes the primary signatory on the response and the primary voice on the dispute language. The advisor briefs counsel on the substantive analysis; counsel reframes that analysis in the language the response requires.3

The advantage of the division is that the customer pays for one analytical channel rather than two. Counsel is rarely a strong substantive reader of Red Hat subscription terms; the advisor is rarely the right voice on dispute language. Engaging both at full analytical effort doubles the cost without doubling the response strength. The practice's protocol is the more efficient division: substance from the advisor, voice from counsel, settlement signed by the customer.

The note on Red Hat audit defense as a service describes the engagement structure that supports this division. Where counsel is in place from the customer's side, the practice operates as the analytical channel under the engagement counsel structures.

Counsel adds time and cost. The trade against either is the strength of the response. Where one of the triggers in § 2 holds, the cost of not engaging counsel is materially higher than the cost of engaging. Where none of the triggers hold, the cost of engaging counsel is rarely justified by the response work.

Counsel is brought in to answer questions the advisor cannot answer, not to repeat the work the advisor has already done. Customers who engage counsel for confidence rather than for triggers find the engagement consumes audit defense budget without changing the audit outcome. Customers who engage counsel at the moment a trigger turns find the engagement protects positions that would otherwise be lost.

If the audit notice is in hand and any of the triggers in § 2 appear to apply, the first useful hour is a call with the practice to read the triggers and coordinate the counsel question. The note on why Red Hat audits look different from IBM audits treats one of the contextual triggers in more depth; the note on regulated industries Red Hat audits treats another.

Preparing a response? The practice keeps a one-page Red Hat audit response checklist — what to acknowledge, what to preserve, and what not to volunteer in the first fourteen days after the letter arrives.